WordPress Plugin Vulnerabilities
GTranslate < 2.8.52 - Unauthenticated Reflected Cross Site Scripting (XSS)
Description
The GTranslate plugin before 2.8.52 for WordPress was vulnerable to an Unauthenticated Reflected XSS vulnerability via a crafted link. This requires use of the hreflang tags feature within a sub-domain or sub-directory paid option.
The vulnerability was due to outputting the WordPress add_query_arg function without prior escaping.
Proof of Concept
Affects Plugins
Fixed in 2.8.52 References
Classification
Type
XSS
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Gaurav
Submitter
Gaurav
Submitter twitter
Verified
No
WPVDB ID
Timeline
Publicly Published
2020-04-20 (about 6 years ago)
Added
2020-04-20 (about 6 years ago)
Last Updated
2020-05-20 (about 5 years ago)
WPScan 